Hackers Hosed by Google Were a Counterterrorism Operation

With tech companies gobbling up more and more user location data all the time—and governments tapping into those troves any way they can—a group of technologists in the United States and United Kingdom debuted 10 principles this week, the Locus Charter, for ethical retention and uses of location data. Facebook announced research into the Chinese hacking group Evil Eye, which has continued to launch espionage campaigns targeting Uyghurs. In this latest case, the group used front companies to develop spyware and carefully distributed both Android and iOS malware through fake app stores and tainted websites. 

Meanwhile, a strain of ransomware called DearCry has been piggybacking off the same Microsoft Exchange vulnerabilities originally exploited by Chinese hackers for espionage worldwide. And dark web marketplaces are overflowing with Covid-vaccine-related scams, hawking fake doses and forged proofs of vaccination.

In an attempt to cut down on the threat posed by browser-related attacks, companies like the internet infrastructure firm Cloudflare are developing a new generation of “browser isolation” tools that keep malicious code from running directly on your computer, while being faster and more usable than past iterations. 

And there’s more. Each week we round up all the news WIRED didn’t cover in depth. Click on the headlines to read the full stories. And stay safe out there.

Last week, Google’s Threat Analysis Group and its Project Zero bug-hunting team revealed that a single, unidentified hacking group had been using a whopping 11 previously unknown security vulnerabilities  in a spree of digital attacks over nine months in 2020. Google provided no details or hints, though, about who the hackers might be. On Friday, MIT Tech Review reported that the hackers are agents from a Western government who were conducting a counterterrorism operation. The situation only adds to an already ongoing discussion about the logistics and parameters of vulnerability disclosure when it pertains to covert activity being conducted by a “friendly” government. The vulnerabilities in this case were in ubiquitous software like Google’s own Chrome browser for Windows 10 and Apple’s…